POST /v1/session/refresh now returns refresh_token in the response

Refresh tokens now rotate on every use, with a 10-second grace window to tolerate concurrent refresh calls from the same client. Because of this, POST /v1/session/refresh now returns a new refresh_token in its response body — not just a new access_token — and callers must save and use it on the next refresh. Continuing to send the old refresh token after the grace window closes is treated as reuse and revokes the session.